# This configuration file contains lists.debian.org specific rulessets

# our MTAs fix up headers for a slew of spams, so mark these as suspicious
# -- joy, 2003-06-28
# deactivated as this rule is also part of SA itself.
#header OUR_MTA_MSGID		Message-Id =~ /\@(bendel|master|gluck)\.debian\.org/
#describe OUR_MTA_MSGID		Sounds like a MsgId autogenerated by our MTAs
#score OUR_MTA_MSGID		1

# -- joy, 2003-08-15
header SENDER_FOR_US	From =~ /\@(bendel|master|gluck|lists)\.debian\.org/
describe SENDER_FOR_US	Sounds like a mail aimed at tricking our MTAs
score SENDER_FOR_US	2

# exception... --joy, 2003-07-12
header WEBSUBS			X-Remote-IP =~ /./
describe WEBSUBS		Sounds like a subscription request from the web
score WEBSUBS			-2

# another exception... --joy, 2003-07-27
header SUBSCONFIRM		Subject =~ /CONFIRM [su]\d+/
describe SUBSCONFIRM		Sounds like a subscription request confirmation
score SUBSCONFIRM		-2

# some valid autogenerated mail of ours
# -- joy, 2003-07-09
header OUR_SCRIPTS_1		Orig-From =~ /.+\@debian\.org \(.+ as listmaster\)/
describe OUR_SCRIPTS_1		Mail likely generated by .bin/mladmin
score OUR_SCRIPTS_1		-5

# our daily un/subscription report gets ~8 SA points !
# lower it to 3
# -- zobel, 2006-12-10
header _OUR_UNSUB_CHANGES1	Subject =~ /Daily un\/subscription report/
meta OUR_UNSUB_CHANGES		(_OUR_UNSUB_CHANGES1 && OUR_MTA_MSGID)
describe OUR_UNSUB_CHANGES	Daily mail sent to listmaster about un/subscriptions
score OUR_UNSUB_CHANGES		-5

# exception... --joy, 2003-08-15
body MDOMOSUBS		/^Request forwarded.$/
describe MDOMOSUBS	Sounds like a subscription request via majorsmart
score MDOMOSUBS		-2

# another exception --joy, 2004-05-27
#body OURCRONMAILS	Subject =~ /^Cron \<list\@.*\/var\/list\//
#describe OURCRONMAILS	Sounds like a legitimate cron job mail
#score OURCRONMAILS	-3

header BENDEL_LOCAL_FORWARDED	Resent-From =~ /bendel\.debian\.org/
describe BENDEL_LOCAL_FORWARDED	Mail has been locally forwarded.
score BENDEL_LOCAL_FORWARDED	-5

# temp work-around for d-l-f

header RFR  Subject =~ /\[RFR\]/
describe RFR Request for revision
score RFR -5

# pasc 2004-02-02
header AM_REPORT	Subject =~ /AM Report for Week Ending/
describe AM_REPORT	Auto-generated AM summary
score AM_REPORT		-5

# automated reports on debian-l10n-french
header MURPHY_MIGUS_REPORT	Subject =~ /Etat dans le CVS des/
describe MURPHY_MIGUS_REPORT	Auto-generated report from migus on translations
score MURPHY_MIGUS_REPORT	-5

# our own whitelisting of subscribers
header LDOSUBSCRIBER		X-Subscriber-lists.debian.org =~ /./
describe LDOSUBSCRIBER		Sender is a lists.debian.org subscriber
score LDOSUBSCRIBER		-6

# whitelist mails to majordomo
header MAJORDOMOMAIL	Delivered-To =~ /lists-majordomo@/
describe MAJORDOMOMAIL	mail to major domo
score MAJORDOMOMAIL	-0.1

meta  	 MAJORDOMOWHITE	(MAJORDOMO && (NOSUBJECT || MISSING_SUBJECT))
describe MAJORDOMOWHITE	Counteract no subject score for majordomo mails
score	 MAJORDOMOWHITE	-3

# count recipients and score those with Too Many. -cord
describe TO_TOO_MANY To: too many recipients
header   TO_TOO_MANY To =~ /(?:,[^,]{1,80}){5}/
score    TO_TOO_MANY 1

describe TO_WAY_TOO_MANY To: way too many recipients
header   TO_WAY_TOO_MANY To =~ /(?:,[^,]{1,80}){10}/
score    TO_WAY_TOO_MANY 3

describe CC_TOO_MANY CC: too many recipients
header   CC_TOO_MANY CC =~ /(?:,[^,]{1,80}){10}/
score    CC_TOO_MANY 3

score CORRUPT_FROM_LINE_IN_HDRS	0
score FM_DDDD_TIMES_2           0
score FM_SEX_HOSTDDDD	        0
score NO_HEADERS_MESSAGE	0
score SARE_HEAD_SUBJ_RAND	0
score SARE_SPEC_PROLEO_M2a	0
score SHACKOUTLOOK	        0
score MSGID_FROM_MTA_ID		0
